Privacy Policy - HHD App

1. Introduction

Welcome to the HHD App ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application ("App") for managing hostel operations at Huis Hermann Davin.

By using the HHD App, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use the App.

2. Information We Collect

2.1 Personal Information

We collect the following personal information:

• Email Address: Used for authentication via magic link login
• Full Name: Displayed in your profile and used for identification
• User Role: House Father, Teacher, Prefect, Parent, or Learner
• Profile Information: Additional details relevant to your role and hostel operations

2.2 Device Information

To ensure secure device management and prevent unauthorized access, we collect:

• Device Identifier: A unique device ID generated by the app (not your hardware serial number)
• Device Model and Operating System: For compatibility and support purposes
• BLE Advertisement Code: A unique code used for Bluetooth Low Energy phone collection tracking

2.3 Location Information

We request location permissions on Android devices to enable Bluetooth Low Energy (BLE) scanning functionality, which is required for the phone collection system. We do not collect, store, or transmit your precise location data. Location permission is only used to comply with Android's BLE scanning requirements.

2.4 Bluetooth Information

The App uses Bluetooth Low Energy (BLE) for phone collection tracking:

• Learners: The app broadcasts a unique BLE advertisement code when handing in phones
• Prefects: The app scans for nearby BLE devices to detect phone hand-ins
• No personal data is transmitted via Bluetooth - only anonymous device codes

2.5 Push Notification Tokens

We collect push notification tokens through Firebase Cloud Messaging to send you important updates and notifications related to hostel operations (e.g., checkout approvals, roll call reminders).

2.6 Usage Data

We may collect information about how you access and use the App, including:

• Checkout requests and approvals
• Phone collection records
• Roll call attendance data
• Calendar events and activities

3. How We Use Your Information

We use the collected information for the following purposes:

• Authentication: To verify your identity and provide secure access to the App
• Device Management: To enforce one-device-per-user policy and prevent unauthorized access
• Hostel Operations: To manage checkout requests, phone collection, roll calls, and other hostel activities
• Communication: To send push notifications about important events and updates
• Role-Based Access: To provide appropriate features and permissions based on your role (House Father, Teacher, Prefect, Parent, or Learner)
• Support: To provide technical support and respond to your inquiries

4. Data Storage and Security

4.1 Data Storage

Your data is stored securely using:

• Supabase: Cloud database service for user profiles, authentication, and app data
• Firebase: Cloud service for push notifications
• Local Storage: Limited data cached on your device for offline functionality

4.2 Security Measures

We implement appropriate technical and organizational measures to protect your information:

• Row Level Security (RLS) policies to restrict data access based on user roles
• Encrypted connections (HTTPS/TLS) for all data transmission
• Secure authentication using magic link tokens
• Device fingerprinting to prevent unauthorized access
• Regular security audits and updates

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• Within the App: Information is shared with authorized users based on their roles (e.g., parents can see their children's checkout status, prefects can see learners in their assigned groups)
• Service Providers: We use Supabase and Firebase as service providers, who are contractually obligated to protect your data
• Legal Requirements: If required by law or to protect our rights and safety

6. Your Rights and Choices

You have the following rights regarding your personal information:

• Access: You can view your profile information within the App
• Correction: You can update your profile information through the App settings
• Deletion: You can request deletion of your account by contacting us (subject to hostel operational requirements)
• Permission Control: You can grant or revoke permissions (Bluetooth, Location, Notifications) through your device settings
• Opt-Out: You can disable push notifications through your device settings

Note: Some information may be retained for legitimate hostel operational purposes even after account deletion, in accordance with school policies and legal requirements.

7. Children's Privacy

The HHD App is designed for use by learners (students), parents, teachers, and administrators. We take the privacy of children seriously. Personal information of learners is collected only with appropriate consent from parents or guardians and is used solely for hostel management purposes.

8. Data Retention

We retain your personal information for as long as necessary to provide the App's services and fulfill hostel operational requirements. Data may be retained longer if required by law or school policies.

9. International Data Transfers

Your information may be stored and processed on servers located outside of South Africa, including in the United States and European Union, through our service providers (Supabase and Firebase). These providers are committed to maintaining appropriate data protection standards.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

11. Contact Us

12. Governing Law

This Privacy Policy is governed by the laws of South Africa. Any disputes arising from this policy will be subject to the exclusive jurisdiction of the courts of South Africa.